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(57) AL-s***»cl: -ins, mcw.ii «->.•: ipnlcr rt&dzll' 
media for enabling a server device (.V» 10 validate one or 
more client devices (1). A shared unpredictable secret 
(50) is generated. The shared unpredictable secret (50) is 
stored in the client device (1) and in the server device (5). 
The client device (1) proves possession of a correct shared 
unpredictable secret (50) to the server device (5). The 
shared unpredictable secret (50) is replaced by a new shared 
unpredictable secret (54) each time the client device (1) is 
validated by the server device (5). 
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These and other more detailed and specific objects and 
features of the present invention are more fully disclosed in 
the following specification/ reference being had to the 
accompanying drawings/ in which: 
5 Figure i is a block system- level diagram of a preferred 

embodiment of the present invention. 

Figure 2 is a flow diagram of a preferred embodiment of 
the registration/reset phase of the present invention. 

Figure 3 is a flow diagram of a preferred embodiment of 
10 the log- in phase of the present invention.. 

Figure 4 is a flow diagram illustrating an alternative 
embodiment of the method illustrated in Figure 3. 

Figure 5 is an illustration of shared unpredictable secret 
50 and its progeny. 
15 Detailed Description of the Preferred Embodiments 

As used in the present patent application, client 
(sometimes referred to as "client device") 1 can be any digital 
•i. -.-ice, e: « ^ . . u p.-irs=onal cor^-^ex , incM ir-* c\r v.?c, ^.ciri- c^~^ , 
liilierjcc^. appliaiz^e , or a:o.y otr^~ nst.v.rlc av-,ci?Bi-:'Ie ^"'^.ot. 
20 There may be one client 1 cr, as illucn:. , : a Figure j. , a 
finite number n of clients 1. Each client I wishes to 
communicate with an inf rastructural component that is referred 
to in the present patent application as a server (or "server 
device") 5. Server 5 may provide any type of service to. client 
25 1. For example, server 5 might be an Internet service provider 
or a telephone network access point. The communications link 
between client 1 and server 5 may be any link, such as a 
wireless link, a wired link, or a link over a network 4, which 
may be an open network such as the Internet. The process that 
30 commences with client 1 requesting validation with server 5 and 
including server 5 checking proof data that client 1 has 
generated from the shared unpredictable secret 50 is referred 
to herein as a "log-in". A log-in results in client 1 being 
either validated or not validated by server 5. 
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Description 
COUNTERING CREDENTIALS COPYING 

Inventor: Warwick Ford 

Related Application This patent application is related to and 
5 claims priority from U.S. provisional patent application serial 
no. 60/226,429 filed on August 18, 2000, entitled "Countering 
Credentials Theft", having the same inventor and assignee as 
the present patent application. 

Technical Pield This invention pertains to the field of 
10 authenticated communications between and among digital devices 
such as computers, and, specifically, pertains to techniques 
for thwarting the copying of credentials by nefarious persons 
or otherwise. 
— Background Art 

15 Dif f ie-Hellman key exchange, as described in U.S. patent 

4,200,770, is a mechanism to permit two entities to- b^vs a 

p:«--:^:--ut invent ! -J,. ^lie-red vuvpred^.otaiile secret SO \~ nor. an. 
encryption key. 
20 Disclosure of Invention 

The present invention comprises systems, methods, and 
computer readable media for authenticating a -client device (1) 
to a server device (5) . A preferred method comprises the steps 
of generating a shared unpredictable secret (50), storing the 
shared unpredictable secret (50) in the client device (1) and 
in the server device (5), and requiring the client device <1) 
to prove that it contains the correct shared unpredictable 
secret (50) as a precondition to the server device (5) 
validating the client device <1) . The shared unpredictable 
secret (50) is replaced by a new shared unpredictable secret 
(54) each time the server device (5) validates the client 
device (1) . 

Brief Description of the Drawings 
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- one concern in such an environment pertains to credentials 

sharing. In this scenario, a person who has access to a client 
device 1 voluntarily shares his personal credentials, such as a 
password or private cryptographic key, with other user devices 
5 2 . All of these user devices 2 employ the user account of the 
original user. Two problems that arise from this scenario are: 
1) It is difficult for server 5 to hold particular users 2 

f; accountable for their actions when using the services provided 
by server 5, since some or all users 2 are indistinguishable 

10 from each other; and 2) Users may fraudulently avoid paying 
subscription fees that are designed for payment on a per-user 
basis. 

Another concern is outright credentials theft. In this 
scenario, a nefarious person having access to a client-like 

15 device, referred to as "attacker 3" in Figure 1, penetrates a 

legitimate client device 1, copies stored credentials data from 
client device 1 into attacker device 3, perhaps supplements 
ir.izr'* tlr^v^ry vita e. -eLeri.n nati on of ' "th^r :atcr .^V..ioii ^uch &r. 
the user'./ password: p^r£..^nl :\c ratification ..aitv^or, or soci^..- 

20 security number from other acuxa^s, and then masquerades as the 
legitimate user from the attacker device 3. When the client 
device 1 being attacked is a hardware device and not a software 
module, this scenario is sometimes referred to as "device 
cloning". Client devices 1 that are typically cloned include 

25 mobile telephones and smartcards. 

The present invention also applies to the copying of a 
portable credentials storage medium such, as a magnetic stripe 
card or ticket if that medium is writable as well as readable 
by the terminal device in which it is used. In this case, the 

30 term client device 1 is taken to mean the combination of the 
portable credentials storage medium and the terminal device in 
which it is currently inserted. 

The present invention uses a method of stateful 
authenticators to provide a low cost, low overhead means of 

35 detecting when one user account is being employed for more than 
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one client device 1 over a period of time. Specifically, the \\ 
stateful authenticator used herein is a shared unpredictable 
secret 50. The present invention has utility in countering 
credentials sharing behavior by effectively restricting use of 
5 a user account to one or a limited number of client devices 1. 
The invention also counters credentials theft by means of 
detecting the use of one user account from more than one client 
device 1 after stored credentials have been copied between \. 
client devices 1, regardless of how easy or difficult it was to 
10 copy the credentials from the original device 1. 

All of the method steps illustrated herein describe 
modules that can be implemented in hardware, software, and/or 
firmware. Some of these modules reside on the client deviee 1 
and some on the server device 5, as will be readily understood 
15 by examining the Figures in conjunction with the following 

description. • * A 

The method will first foe described with respect to a 
special cose in whinh chore is but one legitimate client device 
X i:he:- • cue fc:;c i- . - -so* the -.^■-thu-. : of i:^-. prsc;:.nt 
zrr.'z :atio>i: a. ^ ^*iscr£tio-/u. -sec )j-J\3**:z v,nd a iog-iv; "Dha^o. 

Figure ^; Illustrates the registration/reset piiase. In 
step 21, client 1 typically presents a user's authentication 
data to server 5. The ensuing dialog between client 1 and 
server 5 is geared to determining whether the user associated 
with client 1 is legitimately associated with a claimed user 
account. The authentication data presented by client 1 may 
include private personal data, a response to a pre-established 
challenge question posed by server 5, a biometric input such as 
a fingerprint or an eyeball scan, etc. Alternatively, the 
registration/reset phase may involve the user making a payment > 
in which case authentication data may or may not need to be 
presented by client 1 to server 5. The payment can be made by 
client 1 securely crediting server 5's account, and oan be made 
online or offline. The registration/reset phase is typically 
undertaken less frequently than the log-in phase. 
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At step 22, server 5 decides whether the authentication 
data presented by client 1 are acceptable. If not, client 1 is 
not allowed to register (step 26) . If acceptable, client 1 is 
5 allowed to register (step 23). In this eventuality, the shared 
5 unpredictable secret 50 is generated (step 24) . 

As illustrated in Figure 5, the shared unpredictable 
secret (SUS) 50 comprises an unpredictable component 51 and an 
optional fixed component 52. Unpredictable component 51 may be 
generated by a random number generator or a pseudo-random 
10 number generator. Typically, unpredictable component 51 is 

generated at server 5 and communicated to client 1, but it may 
also be generated at client 1, or at a combination of server 5 
and client 1. As an alternative to communicating unpredictable 
component 51 to client 1, unpredictable component 51 may be 
15 pre-installed in client device 1 during manufacture or during a 
device 1 personalization process. 

When used, fixed component 52 typically comprises 

iuhy Lo a -eri.-l ^•■^v.u ct o.j i-nt '*:vic/: r^is rcxl-l 

20 useful when there are two or more client devices 1 a:^^;; - -^ed 

with the same user account number. Conversely, fixed component 
52 could be the user account number when there is more than one 
user account number associated with the same client device 1. 
This situation may occur, for example, when a user has one 

25 account number for business use and another account number for 
personal use; or when two users share the same cellular 
telephone 1; or when the client device 1 is a terminal into 
which users insert their credentials storage media. 

Typically, after server 5 has generated SUS 50, server 5 

30 transmits SUS 50 to client 1. The transmission is preferably 
encrypted, for reasons of security. Any type of encryption, 
including symmetric or asymmetric encryption, may be used. 

* Alternatively, an SUS 50 having an unpredictable component 51 
is generated by the aforementioned Dif f ie-Hellman key exchange 

35 technique, or pre- installed in device 1 as described 

5 
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previously. The same SUS 5 0 is stored in both server 5 and 
client 1 (step 25) . SUS's 50 may be stored in a secure 
fashion, such as using tamper-resistant hardware protection, 
e.g., epoxied integrated circuits, or by means of dynamically 
changing the location of SUS 1 s 50 (and new SUS's 54) in 
storage. 

Figure 3 illustrates the basic method of the log-in phase. 
The log-in, at least for legitimate users, is not meant to be 
attempted until after the registration/reset phase has 
successfully concluded. Steps 30, 31, and 32 are optional. At 
step 30, client 1 presents credentials to server 5. The 
credentials may include a password, personal identification V, 
number (PIN), a transformed (e.g. hashed) password, biometric 
signature, portable credentials medium identifier, or 
15 cryptographic authentication proof generated from a private 
cryptographic key. Since log-ins normally occur more 
frequently than registration/resets, the character and content 
°- t:he credential?? cind procedure are such that the server' s 
check c" t-he r» :^ r . i, ty ]: i,*liy slapl^r r~A ^ 
0 tlv> server's check tite user-s aut>-.-. ication data iii 

previously- described step 21. In step 31, server 5 checks the 
credentials. If the check fails, typically the client is not 
validated (step 32) . 

If step 32 is entered, one or more things may happen. For 
example, client 1 may be totally rejected and not allowed to be 
validated ever again. Less onerously, client 1 could be given 
reduced privileges, such as the ability to read a Web page 
stored on server 5 but not to conduct any financial 
transactions thereon; or client l could be made to re-enter the 
registration/reset phase. 

If the check passes, the method moves to step 33, where 
client 1 presents proof data to server 5. The proof data 
allows server 5 to verify that client 1 holds a correct secret 
50, 54. (Normally, the secret is SUS 50. However, the secret 
could be new SUS 54, in the case where the log-in is a 
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subsequent log-in following the re-set of server 5 as described 
in conjunction with step 43, below. For purposes of 
simplifying this discussion, it will be assumed that the proof 
data are computed upon SUS 50.) It is desirable that SUS 50 
5 itself be not directly communicated over an open network 4 lest 
it be intercepted by a nefarious person. One method by which 

' * client 1 computes proof data without revealing SUS 50 itself is 
for client 1 to compute a one-way function of SUS 50. The one- 
way function is typically a cryptographic hash function. Then, 

10 at step 34, server 5 checks the proof data by applying its 
(server 5»s) proof data generation algorithm to its (server 
5 's) stored version of SUS 50. If the proof data generated by 
server 5 matches the proof data presented by client 1, client 1 

■ l has passed the test, and. the method proceeds to step 37. 

15 Otherwise, client 1 has failed the test and is not validated at 
step 32. Step 32 operates as previously described. 

In order for this method to work, client 1 and server 5 

; .ve v:.o bv- a-.-i.nn c.\ -:-siatent if uot id-tntiv*! prcoot" d*ta 

^enc:c-cLt:.;:.cn a.i.cc^iti^ . i~ i« vv-.^iat-- ^\ -L .Ucr or nc?t- an 

20 eavesdropper knows what this : -oritL^i i.v * v/hat 
algorithms are) . 

At step 37, update data 53 and a new shared unpredictable 
secret 54 are generated, typically by sever 5. On Fig. 3 
(boxes 37 and 39), item 54 is referred to as a "secret" rather 

25 than a "shared unpredictable secret", because the contents of 
the storage area that server 5 uses for SUS's are not replaced 
with new SUS 54 until step 40 is executed, below. Thus, the 
secret is not yet "shared". 
• Then, at step 38, server 5 sends update data 53 to client 

30 1. Update data 53 is such that client 1 and server 5 are able 
to generate new SUS 54 from the most recent version of SUS 50, 
by means of applying update data 53 thereto. Typically, the 
step of applying update data 53 to SUS 50 comprises computing a 
one-way function of the combination of SUS 50 and update data 

35 53. For example, update data 53 could be a new random or 

K 7 
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pseudo-random number that client 1 and server 5 XOR with old 
SUS 50 m order to generate new SUS 54, Alternative to the ne€ 
of update data 53, server 5 could send an encrypted new SUS 54 
to client 1, but the advantage of sending update data 53 is 
5 that update data 53 do not have to be encrypted, thus making 
for a simpler and less cumbersome protocol. In an alternative 
embodiment, in situations where the optional acknowledgement 
data are used (see below) , server 5 sends to client 1 an old 
SUS 50 that hasn't been acknowledged yet . ^\ 

10 At step 39, client 1 updates its (client I's) storage area 

that is allocated to SUS ■ s with new secret 54. Client I's 
storage area may be on a portable credentials storage medium. 

Steps 41, 42, and 43 are optional. Without these steps, 
the method illustrated in Figure 3 works well when the 

15 communications channel 4 is clean and uncorrupted, but a 

potential problem arises in the case of a noisy or corrupted 
channel 4: update data 53 could be lost in transit between 
client 5 i-nd server 1 . or client 1 could fail to correctly 
ore ™>* - >n::;et '--I . 

20 The .i- ; c*': --sicr^ or f.Lav-s 41, 42, and 43 resolve the prv^l-m 

of noisy or corrupted channels 4 or a malfianctivx.^^g client 
device 1, through the use of acknowledgement (ACK) data. In 
step 41, client 1 sends the ACK to server 5 after client 1 has^ 
successfully received update data 53 and stored the new secret 

25 54. The ACK may optionally contain proof data allowing server 
5 to verify that client 1 has successfully computed the new SUS 
54 . The proof data should not be the same proof data as used 
in step 33; otherwise, a replay attack would be possible. 

At step 43, server 5 is set (e.g., programmed) to accept 

30 proof data emanating from any SUS's since the previous 

validation, plus new SUS 54. Another way of saying this is 
that server 5 is adapted to accept from client 1 any proof data 
that are generated from a secret that is newer than the secret 
for which the most recent acknowledgement data have been 

35 received by server 5. Thus, if the situation is that -client 1 

8 
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has received the update data 53 , but for some reason the ACK 
has been lost in transit, during the next log- in, client 1 at 

• step 33 will be presenting proof data emanating from new SUS 

54, and server 5 at step 34 will be programmed to accept said 
5 data. If, on the other hand, update data 53 were not received 
by client 1, then, during the next log-in, client 1 at step 33 
will be presenting proof data emanating from an old SUS 50, and 
server 5 at step 34 will be programmed to accept said data. 

Step 42 illustrates the reality that server 5 may or may 

10 not receive the ACK, either because the update data 53 were 
lest in transit, the ACK was lost in transit, or the client 
device 1 failed. If server 5 receives the ACK within a 
preselected "time-out" period, then client 1 is validated at 
step 44 and step 40 is entered into. At step 40, server 5 

15 updates its (server 5's) storage area that is allocated to 

SUS's with new secret 54. Thus, new secret 54 becomes a new - 
shy. red unpredictable secret* because it. .is now shared by client 
1 and =::'-•: *e . 5. • ^ .-<- >.?tew : o b^-o -*C. ^erve, d«? < 
-10 and any -V - vr ZViz • s £::cm 11 & • *r :j- ... r:.yc,-/~ 1 3 . 

20 Thus, in future log-in attempts, both client 1 And server 6 

will have stored therewithin new SUS 54; and the proof data (of 
client 1 in step 33 and server 5 in step 34) will be based upon 
new SUS 54 . 

If, on the other hand, server 5 does not receive at step 
25 42 the ACK from client 1 during the time-out period, client 1 
is not validated at step 32, which executes as described 
previously. 

The protocols described herein have the following 
desirable properties: 1) Any SUS (50) value produces no more 
30 than one validation; and 2) If the protocol fails at any stage, 
both client 1 and server 5 are left in a state that a new 
invocation of the protocol will operate correctly. 

Optionally, for example in conjunction with step 34, 
server 5 maintains an audit trail -of log-in attempts, noting in 
35 particular those log- in attempts in which the step 34 checks 
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have failed. Each audit record should contain the then- current 
values of old SUS 50 and new SUS 54. In the event a legitimate 
user disputes accountability for actions attributed to use of 
his account, if server 5 maintains an audit trail of log-in 
5 attempts, the service provider or systems administrator can use 
the audit trail in resolving such disputes. \., 

By using the techniques described herein, any user 
possessing or knowing correct credentials and attempting a log- 
in from a client device 1 that holds the correct SUS 50 will 
10 succeed in being validated, even in the event a log-in sequence 
is not successfully completed, owing, for exan^le, to a 
communication or system failure. 

The present invention automatically protects against ^ 
message replay, i.e., the situation where an eavesdropper 
15 records a session and plays it back. This is because a new SUS 
54 is generated at each successful validation. 

If the legitimate user of the credentials voluntarily 
• shares bis credentials wiLh or.e or more other users who will be 
v <•>-...:.. xr- t:9=vc:nr_:~ .rr-vocvnes en ?_ lleg; : '-.Imotc Client 
20 device 2, only c-o client (lesiLimate client 1 or illegitimate, 
client 2) can successfully log in subsequently without server 5 
invoking special action, such as causing the requesting client 
1,2 to re-execute the registration/reset phase. This 
represents a disincentive for the legitimate user to share his 
25 credentials , since his own usage of his account will be 
negatively impacted. 

If the legitimate user's credentials are copied in a 
credentials theft, then one of the following scenarios will K ' 
subsequently occur: 
30 U The legitimate client 1 logs in again before the 

attacker 3 attempts to masquerade as a legitimate user. In 
this case, the attacker 3 log-in will be alerted to the server 
5 and consequently be subject to special action, such as 
rejection outright or granting of reduced privileges. 

10 
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2) The attacker 3 logs in before legitimate client 1 logs- 
in again. In this case, attacker 3 can successfully masquerade 
as a legitimate user up to the time of the legitimate user's 
next log-in. On the legitimate user's next log-in, server 5 
5 will be alerted and special action taken. This special action 
might include out-of-band communication with the legitimate 
user, investigation of the situation, and consequent shut-out 
of attacker 3 from further validations. 

An alternative embodiment is illustrated in Figure 4. The 
10 method of claim 4 is identical to the method of Figure 3 

wherein acknowledgement data are used, except that steps 33 and 
34 are consolidated into steps 41 and 42. Thus, in the Figure 
4 embodiment, unlike the Figure 3 embodiment, the presentation 
of proof data by client 1 and the checking of the proof data by 
15 server 5 are not performed prior to server 5 generating update 
data 53 and new secret 54 in step 37. 

Step 50 of Figure 4 replaces step 41 of Figure 3. In step 

_ -j J _ -: - : , "i .^i %. a r ^—.-. r ,:= . r aTi:": tbe ^CiOClfWlcd.Oir^mCO.t 

t ; f C-.-. — — -. '- ■ - - - - t~ • — 

• J. -a i:.r-. server 5. j-r. -of ^v.La :u-w cornet c- 1:lv- 

20 .-■>-:;ret 54. .the proof a..-- . .. could s^r? - - rrti ^- at; ; : ' : 

H data and acknowledgement data. In this ca^ ( ' : .a is no need 

for acknowledgement data separate and apart from the proof 

data. 

Step 51 of Figure 4 replaces step 42 of Figure 3. In step 
25 51, server 5 checks both the proof data and the acknowledgement 
data, or, in the case where the proof data serve the double 
role as proof data and acknowledgement data, the proof data. 

As stated previously, there may be legitimate use of a 
number n of different client devices 1 by a single legitimate 
30 user. In this case, server 5 holds current SUS's 50 and new 
SUS's 54 for each client device 1, and considers each client 
device 1 to be legitimate; and each client device 1 has its own 
unique SUS 50 and new SUS 54. The number n of clients 1 may be 
restricted in accordance with local policy. In this scenario, 
35 SUS's 50, 54 are respectively unique from one device 1 to the 

11 
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next. The registration/reset process has to be undertaken by 
each client device 1 to establish each SUS SO. In all other 
respects, the invention is the same as described above in 
conjunction with the single client 1 embodiment. 

The above description is included to illustrate the 
operation of the preferred embodiments and is not meant to 
limit the scope of the invention. The scope of the invention 
is to be limited only by the following claims. Prom the above 
discussion, many variations will be apparent to one skilled in 
the art that would yet be encompassed by the spirit and scope *.<• 
of the present invention . 
What is claimed is: 



IK 
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Claims 

1. A method for validating a client device by a server 
device, said method comprising the steps of: 

generating a shared unpredictable secret; 
5 storing the shared unpredictable secret in the client 

device and in the server device; 
requiring the client device to prove that it holds a 
correct secret as a precondition to the server 
device validating the client device; and 
10 replacing the shared unpredictable secret by a new 

shared unpredictable secret when the server device 
validates the client device. 

2. The method of claim 1 wherein an initial shared 
unpredictable secret is determined in the client device and in 

15 the server device during a registration step that occurs prior 
to a log-in step. 

3. The method of claim 2 wherein the registration step 
c=---»*-:Ail=? ro.'"'"Ct- checking bor.r t fide.- ?:.he nl;!^:.. device tb.cvo. 

20 4. TI: ,. --ethod of claim 2 wherein, during i:Iie registration 

step, the client device is required to make a payment to the 
user device. 

5. The method of claim 1 wherein the shared unpredictable 
secret is generated by a generator from the group comprising a 

25 random number generator and a pseudo-random number generator. 

6. The method of claim 1 wherein the shared unpredictable 
secret comprises an unpredictable component and a fixed 
component . 

7. The method of claim 1 wherein a plurality of client 
30 devices desire to be validated by the server device; and 

each client device has a unique unpredictable secret 
that it shares with the server device. 

8. The method of claim 1 wherein, following a validation 
of the client device, the server device discards the original 

35 shared unpr edict able secret and stores within the server device 
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a new shared unpredictable secret that can be generated by 
applying update data to the original shared unpredictable 
secret. 

9. The method of claim 1 wherein: 
the server device sends update data to the client 

device; 

t 

the client device applies the update data to the 
shared unpredictable secret to generate a new 
secret; and 

the client device replaces the shared unpredictable 
secret with the new secret* 

10. The method of claim S wherein: 
the server device generates the update data using a 

generator from the group comprising a random '^i 
number generator and a pseudo-random number 
generator; and 
the step of applying the update data to the shared 
•unp r e cT i. c t ob 3. e secret comprises computing a.one-^r/ 
il^z.^\l,o'iz v -the r '~.w*?*:c i;ion t.lz. -* ■ 
V i: :;'xt^icta.blf : s£-..".vce a;ad the ^-pdat-.x r:r. 

11. The method of -claim 9 wherein clie~- r-cvice sends 
acknowledgement data to the server device to confirm that the 
client device has replaced the shared unpredictable secret with 
the new secret* 

25 3-2 . The method of claim 11 wherein, in response to the 

server device receiving the acknowledgement data from the 
client device, the server device: 

validates the client device; and 

discards the shared unpredictable secret and stores 
within the' server device the new secret, which now 
becomes a new shared unpredictable secret. 
13. The method of claim 11 wherein: 

the client device sends to the server device proof 
data demonstrating that the client device holds a 
correct secret; and 

14 
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the server device is adapted to accept from the 
client device any proof data that are generated 
from a secret that is newer than the secret for 
which the most recent acknowledgment data have 
. . 5 been received by the server device . 

14. The method of claim 11 wherein: 

the client device sends to the server device both the 
acknowledgment data and proof data derived from 
the new secret. 
10 15. The method of claim 14 wherein: 

the proof data are computed on the new secret; and 
the proof data serve also as acknowledgment data. 

16. The method of claim 1 wherein: 

the client device presents proof data to the server 
15 device, wherein the proof data are derived from a 

shared unpredictable secret using a proof data 
generation algorithm., and the proof data do not 
div::Ige shax.-J cr.. : ,..uid.l.c;'^le -ccr*^; 

I ' -c server device checks the pxccJZ data Lv v;.. ; \:v.-- a 
20 proof dat"i generation algorithm consist en-: wirh 

the proof data generation algorithm used by the 
client device; and 
when the server device determines that the proof data 
presented by the client device were not generated 
25 from the same shared unpredictable secret that is 

stored in both the client device said in the server 
device, the server device does not validate the 
client device. 

17. The method of claim 16 wherein each proof data 
30 generation algorithm is a one-way function. 

18. A system for enabling a server device to validate a 
client device, said system comprising: 

at least one client device; 
a server device; 
35 a shared unpredictable secret; 

15 
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means for storing the shared unpredic table secret in 

the client device; 
means for storing the shared unpredictable secret in 
the server device; 
5 coupled to the client device and to" the server 

device, means for determining whether the client 
device holds a correct secret; 
coupled to the determining means, means for allowing 
the server device to validate the client device 
10 when the client device proves that it holds a 

correct secret; and * l 
coupled to the client device and to the server 

device, means for replacing the original sharped 
unpredictable secret with a new shared 
15 unpredictable secret when the server device 

validates the client device. 
19. A computer readable medium containing computer 
ptrogx'^Tr. \ n s L: ; u c t. i an e for enabling a ser ; er device : co validate 
•-.Xi.ei:-~ devi»---. ...>iid o-..^\u^rr v .,; h :.coc*::.tMi incLi-UC^ v.*--"u3 r:-.v^:i -vj *:hr 
20 ex«-. ' Jon of the f^liov/rtny steps: 

generating a shared unpredictable seer;:- - 

storing the shared unpredictable secret in the client 

device and in the server device; 
requiring the client device to prove that it holds a 
25 correct secret as a precondition to allowing the ^ 

client device to be validated by the server 
device; and 

replacing the shared unpredictable secret by a new 
shared unpredictable secret when the client device 
30 is validated by the server device. 



16 



WO 02/17555 



PCT7US01/25927 



1/5 







ATTACKER 



FIG.1 

m 




•NETWORK 4 



SUBSTITUTE SHEET (RULE 26) 



WO 02/1 7SSS 



PCT/BS01/25927 



2/5 



CLIENT \ 
PRESENTS 
AUTHENTICATION 
DATA. 



Flt3,2 



21 



Authen- 
tication data > 

accepted by 

SERVER 5 



s 22 



YES 

! o I t£ urn 



.REGISTER 



K 2 3 



NO 



CLIENT I 
NOT ALLOWED 
TO REGISTER 



26 .. 



SUS 50 
GENERATED 







24 


SUS 50 
STORED IN 

SERVER 5 ANO 

CLIENTl 


X 25 



SUBSTITUTE SHEET <RUL€ 26) 



WO 02/17555 



PCT/US01/25927 



CLIENT 1 

\' presents 
[credential: 



3/5 /^S 
/CRtD-\ -FAIL 
^ EJITIALS 

.CHECKED^' 

PASS Y 




I CLIENT 1 PRESENTS PROOF DATA 



33 



fERVER\f AIL 
5 CHECKS 
PROOF 
JJATAx^ 
PASS 



CLIENT 1 
NOT 
VALIDA TED 

^ 



'32 



I SERVER 5 GENERATES UPDATE I ' 

! DATA 5? AND NEW SECRET 54 M? 



i SERVER 5 oLNDS UPfouE DATA ■ - CUEnT \ k -38 

T II— - l~ I II Ill n . . ir ■ I I I Ml WSMM | HII ■ - •* 



CLIENT 1 REPLACES SUS 
50 WITH SECRET 54 fo g 

fz 

("CLIENT 1 SENDS ACKNOWLE? 

D GEMENT DATA TO SERVER 5. }MI j 



7T 



SERVER 5 SET TO ACCEPT! 
OUTSTANDING SUS'S . 
SINCE PREVIOUS 
VALIDATI0N 4 PLUSNEW 

SUS 54 J 



43 




5^ECeK WOTl 



NOWLEDGEMENT 




DATA ^< 



42 



FIG.3 



VALIDATED ] 



SERVER 5 REPLACES SUS 
50 WITH NEW SUS 54 



-40 



CLIENT \ VALIDATED 



SUBSTITUTE SHEET (RULE 26) 



WO 02/1 7SS5 



PCT/USOl/25927 



4/5 



I 



CLIENT 1 

PRESENTS F- ~< 
CREDENTIALS 



' CRED-X FAJL 
' ENTIALS <■ 



L^u^mLoJ.. -CHECKED/ 



v 30 



PASS V'll 



CLIENT 1 t» 
NOT 




I 



VALIDATED 

-A7 2 - 



SERVER 5 GENERATES UPDATE 
DATA 53 AND NEW SECRET54 



I 



J— 37 



SERVER 5 SENDS UPDATE 
DATA 53 TO CLIENT 1 



i 



-38 



CLIENT I REPLACES SUS 50 J 

i 'li I X Li - - C ;*f ■ ? ' f*- H r~" V FT .* s-„ 



1 



— r- 



CLIENT 1 SENDS PROOF 
.DATA & ACKNOWLEDGEMENT 
DATA TO SERVER 5 



I 



■50 



(SERVERS SET TO ACCEPT \ 

OUTSTANDING SU^ : S^ i 

SINCE PftfcViGU-S ; 
VALIDATION, PLUS NEW I 

SUS. 54 ~ [ 
v ; i 



i 



M3 



FIG.4 



SERVER 5 
CHECKS PROOF AND 
ACK DATA, 

PASS ~ ' 5 ' 



FAIL 



CLIENTS NOT 
VALIDATED 



32 



'SERVER 5 REPLACES SUS 
50 WITHNEW SUS 54 



40 



CLIENT \ VALIDATED J " — 44 



SUBSTITUTE SHEET (RULE 26) 



WO 02/17555 



PCT7US01/25927 



5/5 





FIG.5 






.1 


I_ 




53 
( 


UNPREDICTABLE 


FIXED i 
COMPONENT i 


UPDATE 


COMPONENT 


DATA 


50 







» 



NEW SHARED 
UNPREDICTABLE 
' SECRET 




SUBSTITUTE SHEET (RULE 26) 



THIS PAGE BLANK (uspto) 



